Privacy policy

This policy describes which personal data are processed on sundaybooks.eu and in our WhatsApp chat (section 16), for what purpose and on what legal basis. Where no processing takes place, this is expressly stated.

1. Controller

The controller for the processing of personal data on sundaybooks.eu within the meaning of the General Data Protection Regulation (GDPR; German abbreviation: DSGVO) is:

YouVenture! GmbH, Ericusspitze 4, 20457 Hamburg

Commercial register: Amtsgericht Hamburg, HRB 172192 · Managing directors: Finn Alexander Dubbels, Viktor Dik · Email: support@sundaybooks.eu

No data protection officer has been designated; there is no legal obligation to do so. Please direct any questions about data protection to support@sundaybooks.eu.

2. Overview: processing that does not take place

In many areas, no data are generated at Sundaybooks. The following therefore sets out first what is not described in the subsequent sections because it does not take place:

• No advertising measurement without consent. The shop does not, of its own accord, set any cookies for advertising or analytics purposes. The Meta Pixel, the Google tag of Google Ads and the associated cookies are only created after you have given your consent in the consent dialogue; if you decline, nothing is sent to Meta or Google for advertising measurement (sections 8.5 and 8.7). Separately from this, we count visits and the steps up to a purchase ourselves — with a random identifier in your browser and without consent (section 6).
• No third-party measurement tools without consent. The Meta Pixel is used for advertising on Facebook and Instagram (section 8.5), and the Google tag of Google Ads for advertising on Google (section 8.7) — both exclusively after consent has been given. Beyond this, neither Google Analytics nor any review widget, newsletter or sending of promotional emails is integrated. Our own visitor count (section 6) is not a third-party tool; its counters are held by our processor Upstash (section 8.6).
• Fonts are self-hosted. They are downloaded once when the website is built and are delivered from our own server. Your browser makes no request to Google Fonts when you visit; your IP address is not transmitted to Google in the process.
• In the editor, the photos remain in the browser during the design process (section 4). This does not apply to a book from the WhatsApp chat: there, you send us your photos, and we process them as described in section 16.
• No AI analysis of the photos in the editor. There, the face detection for the image crop runs on your device and does not identify anyone (section 4.1). In the WhatsApp chat, by contrast, AI models look at your photos in order to design your book (sections 16.3 and 16.5). We use the photos only for your book and not to train AI models; individuals are not identified (sections 16.2 and 16.3).
• No knowledge of payment data. Stripe processes the payment on its own pages; card numbers, IBAN and PayPal login details reach us at no time (section 8.3).

3. Accessing the website

When sundaybooks.eu is accessed, our hosting provider processes the technically necessary access data: IP address, date and time of the request, the address accessed, browser type and version, operating system, the previously visited page and the amount of data transferred. Without this information, it is technically impossible to deliver the page.

The purpose is to deliver the page, ensure its stability and defend against attacks. The legal basis is Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in a secure, functioning service). We do not evaluate these logs for statistical or advertising purposes, do not create profiles from them and do not combine them with anything else. The visitor count in section 6 does not work with these logs but with separate reports sent by your browser. The identity of the hosting provider is set out in section 8.1.

4. Photos, layout and editor

This section describes designing in the editor on sundaybooks.eu. Section 16 applies to a book created in the WhatsApp chat.

4.1 Processing in the browser

The photos for the book are selected in the editor. All processing takes place on your device, in a background process of your browser: preview and thumbnail images, the assessment of sharpness and exposure, the image crop, the automatic layout. None of this is sent to us.

The information stored by the camera (EXIF) is read from the image files: the time of capture, so that the images are in the correct order, the orientation, so that they are the right way up, and — if your camera writes it at all — the location of capture (GPS coordinates). The location of capture serves solely to group photos from the same place into chapters; it is not displayed anywhere and never separates chapters on its own, but only sharpens a boundary that is already plausible.

For the image crop, the editor detects faces, so that no heads are cut off or disappear into the gutter of the book. This is done by a detection model that we deliver ourselves together with the website and that runs entirely in your browser — without third-party providers and without any external interface. Only the position and size of rectangular image areas, together with a confidence score, are determined. There is no biometric identification, no recognition of persons and no matching against any data set. If the model cannot be loaded on your device, your book is created without this aid.

4.2 Where these data are stored

Your original files, the previews and thumbnails calculated from them and the information mentioned are stored in your browser’s local database (IndexedDB). The layout of the book and the basket are stored in your browser’s local storage (localStorage). All of this is on your device. As long as you do not click “Buch sichern” (save book) (section 4.4) and do not complete an order, we have no access to it.

This has a downside that is inherent in this design: if you change device or delete the website data in your browser, your draft is gone. This is not a fault but the consequence of nothing being stored with us. You can delete your books yourself at any time — in the editor or via your browser’s settings.

4.3 Processing when you place an order

As long as you are only designing, everything stays with you. This changes on two occasions, and both times because you trigger it: when you click “Buch sichern” (save book) (section 4.4) and when you click “Zahlungspflichtig bestellen” (order with obligation to pay). A book that is to be printed must leave your browser.

What is then transferred are the photos used in your book and the blueprint of your book — i.e. which image appears in which crop at which position and which text is set on it. We store both in encrypted form in non-public storage; the storage can only be reached via an address containing a cryptographic signature and is located in Frankfurt am Main. Not transferred are the photos that you had in the editor but did not use, and the face frames and GPS data from section 4.1 — these never leave your browser.

From these data, we generate the print file. Together with your name and delivery address, it is sent to our printer (section 8.4). We need your email address for the order confirmation and the shipping notification. The legal basis for all of this is Art. 6 Abs. 1 lit. b DSGVO (performance of the contract of sale).

If you abandon the process without paying, the uploaded data remain stored for 7 days — so that you can return and continue — and are then deleted automatically and completely. No action on your part is required for this.

4.4 Storing a draft via “Buch sichern” (save book)

The editor has a button “Buch sichern” (save book). Its purpose is to let your book survive a change of device — without an account and without logging in. When it is used, your draft leaves the browser, and it does so before any order: we store the blueprint of your book and the original photos used in it (only those used, not your entire photo collection) in the same storage that is also used for orders.

For this purpose, you receive a link with a random identifier. This identifier IS the key: anyone who has the link can open your book and continue editing it. This is intentional, for example for joint editing. The link should therefore only be shared deliberately. We do not set up an account and do not request any information.

The legal basis is Art. 6 Abs. 1 lit. b DSGVO: the storage takes place at your express request and serves to take steps prior to entering into the contract. It does not happen without this click.

A book stored in this way is regarded as a draft: it is deleted automatically and completely after 7 days if it does not result in an order. The dialogue states this period before the link is generated.

5. Storage on your terminal equipment (§ 25 TDDDG)

§ 25 TDDDG governs not only cookies but any storage of information on your terminal equipment and any access to it — and therefore also localStorage, sessionStorage and IndexedDB. A complete list of what we use:

• localStorage — your books and your basket. Without this storage, your book would be lost every time the page is reloaded and your basket would be empty. Strictly necessary for the service you have requested, § 25 Abs. 2 Nr. 2 TDDDG.
• localStorage — your chosen country of delivery. So that the selection does not have to be repeated on every page. Likewise § 25 Abs. 2 Nr. 2 TDDDG.
• IndexedDB — your photos. Original, preview and thumbnail for each image, so that the editor can work with them without uploading them. § 25 Abs. 2 Nr. 2 TDDDG.
• localStorage — a random visitor identifier (`sb.besucher`). A sequence of random numbers that is created on the first visit and remains until you delete your browser’s website data. It serves solely for the visitor count and is not necessary for designing and ordering a book. We do not obtain consent for it. The purpose, the legal basis and your right to object are set out in section 6.
• localStorage — what has already been counted today (`sb.besucher.tag`). Today’s date, the device type (“mobil” or “desktop”) and the names of the steps that your browser has already reported today (such as “besuch” or “editor” with the identifier of the book). This ensures that the same step is not transmitted again every time the page is reloaded and that a rotated tablet does not switch device type in the middle of the day. The entry starts empty on the following day. It belongs to the visitor count (section 6) and, like the identifier, is not necessary.
• localStorage — exclusion from the count (`sb.besucher.intern`). Created only when someone opens the login page of our administration area; it excludes this browser from the visitor count — so that our own visits do not distort the figures.

Of its own accord, the shop sets no cookies for advertising, analytics or recognition purposes. The visitor identifier above is not a cookie, but it does recognise your browser for the count. The only exceptions concern advertising measurement, and they depend on your decision:

• Meta Pixel (`_fbp`, `_fbc`). Only after you have given your consent in the consent dialogue. They attribute your visit to an advertisement. The legal basis is your consent pursuant to § 25 Abs. 1 TDDDG and Art. 6 Abs. 1 lit. a DSGVO; details in section 8.5. If you decline, they are not created. If you then tap a button that opens WhatsApp, we store in localStorage under `sb.chatklick` the codes from section 8.5 with their expiry date, at most fifty. The entry serves solely to delete the associated data held by us if you withdraw your consent; it disappears as soon as our server has confirmed the withdrawal.
• Google Ads (cookies whose name begins with `_gcl` — such as `_gcl_au`, and after a click on a Google ad also `_gcl_aw`). Only after you have given your consent in the consent dialogue. They attribute an order to the Google ad through which you arrived; the Google tag may additionally store the same information in localStorage under names beginning with `_gcl`. The legal basis is your consent pursuant to § 25 Abs. 1 TDDDG and Art. 6 Abs. 1 lit. a DSGVO; details in section 8.7. If you decline, they are not created.
• Your decision itself (localStorage). So that you are not asked again every time you open a page and a “no” remains a no. We store the time, the version of the dialogue and the version of this policy — without this record, consent could not be demonstrated pursuant to Art. 7 Abs. 1 DSGVO. Strictly necessary, § 25 Abs. 2 Nr. 2 TDDDG.

You can change your decision at any time: via “Cookie settings” in the footer. When you withdraw your consent, we remove the cookies and entries of Meta and Google mentioned above insofar as they are stored under our address. A withdrawal takes effect for the future; data transmitted up to that point remain lawfully transmitted (Art. 7 Abs. 3 DSGVO).

This does not apply on Stripe’s payment pages: there, Stripe is the operator and sets its own cookies that are necessary for payment processing and fraud prevention. Details can be found in Stripe’s own privacy policy (section 8.3).

6. Visitor count and purchase funnel

6.1 What is counted

We want to know how many people visit the shop, how far they get on the way to a finished book and at which point they give up. For this purpose, your browser reports individual steps to our server: page accessed, product page viewed, editor opened, photos added, book designed, preview leafed through, added to basket, basket accessed, “Zahlungspflichtig bestellen” (order with obligation to pay) clicked, Stripe payment page reached and purchase completed, as well as a tap on a button that opens WhatsApp (section 16). It also reports when a photo import, the saving of a book or an order fails, or when you cancel the payment at Stripe. No reports are sent by the page showing the status of your order, to which we link by email, or by the order page from the WhatsApp chat and the thank-you page after an order placed from there — we count these steps without a visitor identifier as steps of the chat (section 16.9). The legal notice, the terms and conditions and this privacy policy send only the heartbeat signal from section 6.2. On the pages relating to the WhatsApp chat, we also compare two versions of the price information: which one you see is determined in your browser from the identifier that Meta attaches to an ad click; it is not sent to us for this purpose. We only count how often each version was viewed and how often a button to WhatsApp was then tapped – as daily totals, without a visitor identifier and without an IP address.

6.2 Data transmitted

Each report contains the random visitor identifier from localStorage (section 5) and the step. Depending on the step, the following are added: the identifier of the book from our catalogue (such as “willkommen-baby” or “eigenes-buch”), the device type (“mobil” or “desktop”, derived from the screen width and input method at the first step of the day), in the case of an error its type (such as “network” or “photo upload”) and, for a purchase, the identifier of the Stripe checkout session, which our server uses to verify with Stripe that payment has actually been made. Your photos, texts and book titles, your name, your email address and postal address, and the wording of error messages are not transmitted.

As long as a page of sundaybooks.eu is open in a visible browser tab, your browser additionally sends a heartbeat signal every 45 seconds with the visitor identifier and the area you are in (shop, editor or checkout). This shows how many people are currently present. A tab in the background does not send heartbeat signals.

With every report, our hosting provider sees your IP address, as with every page view (section 3). So that search engines, testing programs and other robots are not counted as visitors, our server compares the browser identifier (user agent) with a list of known search engines, bots and test tools, and the IP address with the address ranges of Meta’s data centres from which Meta checks the pages behind its ads. If either applies, the report is not counted. In that case, we only count that such a request took place and record it in a list of filtered-out requests: time, browser identifier, the reported step including the book, and the network from which the request came — the IP address without its last part (for IPv4 the first three numbers, for IPv6 the first three blocks), never the complete address.

For two per cent of visitors, selected at random on their first counted page view of a day, we also store the browser identifier and the country that our hosting provider derives from the IP address — without a visitor identifier and without an IP address (sample of browser identifiers). We use this to check whether the list misses any robots. Beyond this, we store neither the IP address nor the browser identifier for the count.

6.3 Storage

On our server, the visitor identifier is never stored in plain text, but only as a truncated hash value (SHA-256). This makes it possible to recognise whether the same browser has already reported a step on the same day — each visitor counts once per step per day. The hash value is held in lock entries, which expire at 2 a.m. after the respective day — all entries of a day at the same time, i.e. after at most 26 hours — and in the list of those currently present, from which it is removed a few minutes after the last heartbeat signal, at the latest after just over an hour.

Stored for longer are daily totals — such as “120 visitors, 14 in the editor, 3 purchases”, also broken down by book, device type and time of day, plus the number of filtered-out robot requests (section 6.2). They contain no identifier and do not allow any conclusions to be drawn about an individual. A counted purchase leaves its own lock with the identifier of the Stripe checkout session so that it is not counted twice when the thank-you page is reloaded; it is not stored alongside the visitor identifier and expires after 26 to 27 hours, on the hour.

The list of filtered-out requests holds at most the last 500 entries, the sample of browser identifiers at most the last 300 (section 6.2). An entry drops out as soon as that many newer ones have been added; if no new entry is added for 30 days, the whole list expires.

6.4 Purpose and legal basis

The purpose is to know the reach of the shop, to identify usability problems and to find out at which point customers drop out — for example when importing photos on their phone or shortly before payment. The legal basis is Art. 6 Abs. 1 lit. f DSGVO; our legitimate interest is a shop that works and whose weak points we know. The count remains limited to this purpose: we do not create profiles, do not store the identifier together with orders, names or email addresses and do not pass the data on to anyone except our hosting provider (section 8.1) and the operator of the counting database (section 8.6).

6.5 Objection

You can object to the count at any time (Art. 21 DSGVO). As long as lock entries and entries in the list of those currently present exist (section 6.3), they can be linked to a visitor identifier that you provide to us. If you give us your identifier — it can be found in your browser’s website data for sundaybooks.eu under “sb.besucher” —, we will provide you with information about these entries and delete them. The daily totals contain no identifier and cannot be attributed to anyone.

For nothing to be counted in future, the objection must also take effect in your browser. If you delete the website data of sundaybooks.eu, a new identifier with no connection to the old one is created on your next visit — however, this also deletes the books and the basket stored in your browser (section 4.2). If you block storage for this website in your browser settings, your browser will no longer be recognised but will be counted as a new visitor each time a page loads. The count is avoided entirely only without JavaScript; in that case, however, the editor cannot be used either.

7. Contact form and support

7.1 Data transmitted

You can write to us via the help button. We process your email address, so that we can reply, your message, the page on which you opened the form and a brief technical note on the browser and screen size of your device. The last two items save us having to ask, when providing support, where exactly the problem occurred.

7.2 The screenshot

Optionally, the form attaches an image of the currently visible section of the page. The checkbox for this is preselected; you can untick it. The image is created in your browser without the page being transmitted to a third party for this purpose.

Note: If your book is open at the time, the photos visible on it are part of this image and reach our support mailbox with your enquiry. This is the only way your photos get into our support mailbox, and it is triggered exclusively by you. If you do not want this, untick the box before sending.

7.3 IP address for abuse prevention

To prevent the form from being used to send emails en masse, we briefly count the requests per sending IP address and reject further requests once there are too many. For this purpose, the address is held exclusively in the working memory of the server instance, is not stored permanently and expires automatically after a short time. The legal basis is Art. 6 Abs. 1 lit. f DSGVO (protection against abuse and against costs caused by automated submissions). In addition, the form contains a field that is invisible in itself and that only form robots fill in; it does not process any data about you.

7.4 Purpose, legal basis and retention

The purpose of the processing is to handle your enquiry. The legal basis is Art. 6 Abs. 1 lit. b DSGVO insofar as it concerns a contract or steps prior to entering into one, otherwise Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in answering enquiries).

Your enquiry is not stored in any ticket system or database. It is kept as an email in our support mailbox — together with our reply and the acknowledgement of receipt that is automatically sent back to you. We operate this mailbox with an email provider that acts as our processor in this respect. We delete the correspondence as soon as the matter has been conclusively resolved and no statutory retention obligation precludes this.

8. Recipients and processors

We do not pass on your data to third parties. Exceptions are the following service providers, which work for us exclusively on our instructions and with which a data processing agreement pursuant to Art. 28 DSGVO is in place. Meta (section 8.5) and Google (section 8.7), as advertising partners, are not among them: they receive data for advertising measurement only with your consent and process them under their own responsibility — details in each of those sections. For the WhatsApp chat, there are further recipients: WhatsApp Ireland Limited, a Meta group company, as our processor, and the AI providers Replicate and OpenAI. They are listed with their tasks in section 16.5.

8.1 Hosting — Vercel

We operate our website and its server functions — such as the visitor count, contact form and checkout — with Vercel Inc., USA. In doing so, Vercel processes the access data from section 3 and the reports of the visitor count (section 6.2). The legal basis for the processing is Art. 6 Abs. 1 lit. f DSGVO. For the transfer to the USA, see section 9.

8.2 Email delivery — Resend

We send the emails from the contact form — the enquiry to our support and the acknowledgement of receipt to you — via Resend, Inc., USA. For delivery, Resend uses Amazon Simple Email Service (Amazon Web Services) as a sub-processor. Your email address, the subject and text of the message, the technical context data from section 7.1 and, if included, the screenshot are transmitted. The order confirmation and the shipping notification for an order are also sent via the same route; for this purpose, your email address, your order number and the content of the order are transmitted. The legal basis is Art. 6 Abs. 1 lit. b or lit. f DSGVO, as applicable.

8.3 Payment processing — Stripe

Payment is made via Stripe. For customers in Europe, this is Stripe Payments Europe, Limited, Dublin, Ireland; it may involve its US parent company Stripe, Inc. in the process (section 9).

The payment process takes place on a Stripe page, not on sundaybooks.eu. You enter your payment data — card number, IBAN, PayPal login — there; they reach us at no time, and we cannot retrieve them subsequently either. For an order from the WhatsApp chat, Stripe also collects your name, your email address and your delivery address there and returns them to us, because we need them for the contract, the invoice and shipping. For an order from the editor, you already enter this information with us, and we use it to register you as a customer with Stripe; without an address, Stripe cannot calculate the VAT. We also transmit to Stripe the amount to be paid and, for each book, its title, cover type and number of pages, so that you can see on the payment page what you are paying for — nothing from your photos.

For fraud prevention, Stripe additionally processes technical information about your device and your payment behaviour under its own responsibility. The legal basis for payment processing is Art. 6 Abs. 1 lit. b DSGVO, and for fraud prevention Art. 6 Abs. 1 lit. f DSGVO. Details can be found in Stripe’s privacy policy: stripe.com/de/privacy.

8.4 Printer — MediaPrint

Your book is printed, bound and made ready for shipping by our printer MediaPrint in Germany. We hand over the print file of your book, the book title you have chosen (it appears as the job name on the job ticket) and the name and delivery address for the parcel — nothing more. Your email address, your order number at Stripe and your payment method are not sent there.

The handover takes place via an encrypted connection (SFTP) to a server in Germany. The legal basis is Art. 6 Abs. 1 lit. b DSGVO (performance of the contract of sale). For shipping the parcel, MediaPrint involves Deutsche Post/DHL; only the name and delivery address are sent there.

8.5 Meta (Facebook, Instagram) — only with your consent

We advertise on Facebook and Instagram. In order to recognise which advertisement led to an order or to a chat via WhatsApp, we use the Meta Pixel and the Conversions API of Meta Platforms Ireland Limited, Dublin. Both start only once you expressly consent in the consent dialogue. Without your yes, the pixel script is not loaded, no cookie is created and nothing is sent to Meta.

If you consent, the following are transmitted: the page accessed, date and time, browser and device, your IP address and the Meta cookies `_fbp` and `_fbc`. In addition, the information on which step you have taken — product viewed, added to basket, checkout started, ordered —, in each case with the identifier of the book from our catalogue and, from the basket onwards, the amount; for an order, this is the order value. If you tap a button on our website that opens WhatsApp (section 16), we also report the step WhatsApp chat opened — without book or amount and without anything from the chat itself.

The pixel reports nothing more: we have switched off the automatic events with which Meta, of its own accord, records for example clicks on buttons together with their labels. Pages whose address contains a personal key — the link to a saved book (section 4.4) and the link to the status of your order — are not reported at all; the pixel does not start there.

When you click “Zahlungspflichtig bestellen” (order with obligation to pay) and when your order has been paid, we additionally transmit your email address and the country of delivery — not your name and address, as these may be those of a gift recipient. Neither of them in plain text: this information is first converted on our server with SHA-256 into a non-reversible numerical value. Meta can use this to check whether one of its own accounts matches these values and to attribute the order to the correct advertisement. The plain data reach Meta at no time.

Why twice — pixel and Conversions API? The pixel in the browser is often lost: ad blockers, tracking protection, a closed tab. The same order is therefore also reported by our server. Both reports carry the same identifier so that Meta recognises them as one event and does not count them twice.

Orders via WhatsApp. If, after giving your consent, you tap a button that opens WhatsApp (section 16), we append a short code to the prepared message. You do not see it: it consists of nine non-printable characters directly after the emoji at the end of the message (for example “Hello! I’d like to create a photo book 📸”). The code is a random sequence and reveals nothing about you. Together with it, we store in our database at Upstash (section 8.6): the page on which you tapped, date and time, browser and device, your IP address, the Meta cookies `_fbp` and `_fbc`, the campaign parameters from the address of the page (such as `utm_campaign`), as well as the time and version of your consent and the version of this policy under which you consented. If the message with the code does not reach us within two hours, the database deletes these data automatically. If it does arrive, we link your chat to them, and they are kept for a maximum of eight days from that message; a code is only valid for the first chat that sends it, and if a new one later arrives in your chat, we delete the data relating to the old one. If you pay for an order from the chat during this time, our server reports the purchase to Meta: with the order value and the identifier of the book, and with the page, browser and device, IP address and Meta cookies from your tap. In doing so, we do not report your email address, your name, your address or the order number – someone other than the person who tapped may also pay. We do not report the code, the campaign parameters or the record of your consent to Meta; the code itself passes through the link and your message like any message via WhatsApp (section 16.5). This report comes only from our server and only once; the thank-you page does not report the same purchase again. The contents of your chat – messages, photos, your book – are not part of this report.

Without your consent, we do not append a code and store none of this. We do not use for this purpose any consent you gave before this policy described the invisible code (version of 14 October 2026); you can renew it via “Cookie settings”. If you delete the emoji at the end of the message before sending, the code goes with it, and we link nothing and report no purchase; the same applies if you have objected to the count in the chat (section 16.9). If you withdraw your consent via “Cookie settings” in the same browser, we delete the data relating to the codes that this browser has generated; we do not report a purchase paid for after that. If you have since changed browser or deleted its data, a short message to us is sufficient (section 15).

The sole legal basis is your consent (Art. 6 Abs. 1 lit. a DSGVO, § 25 Abs. 1 TDDDG). We and Meta are joint controllers for the collection and transmission (Art. 26 DSGVO); the agreement provided by Meta for this purpose (“Controller Addendum”) is in place. Meta alone is responsible for what Meta subsequently does with the data. Details: facebook.com/privacy/policy.

Meta Platforms Ireland may transfer data to its US parent company Meta Platforms, Inc., which is certified under the EU-U.S. Data Privacy Framework (section 9). Nevertheless: according to the current state of affairs, a transfer to the USA cannot be fully protected against access by the authorities there. That is precisely why we ask first.

8.6 Visitor count — Upstash

The lock entries, the list of those currently present and the daily totals from section 6.3 are stored in a database of Upstash, Inc., USA. The database is located in Frankfurt am Main. For the visitor count, the following are stored there: the hash value of the visitor identifier, the time of the last heartbeat signal, the counted steps with book and device identifiers, the identifier of a paid Stripe checkout session and the two lists from section 6.2 (filtered-out robot requests with browser identifier and truncated network, sample of browser identifier and country) — no complete IP address, no name, no photos. With your consent, the data relating to a code from section 8.5 are also stored there, including your IP address, for a maximum of eight days from your message with the code (without a message, two hours), and for eight days a note that a purchase has been reported to Meta. Upstash is a US company; access from the USA can therefore not be ruled out (section 9). The legal basis is Art. 6 Abs. 1 lit. f DSGVO (section 6.4), and for the data from section 8.5 your consent.

8.7 Google Ads — only with your consent

We also advertise on Google. In order to recognise which advertisement led to an order, we use the Google tag (gtag.js) for conversion measurement in Google Ads. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The Google tag starts only once you expressly consent in the consent dialogue. Without your yes, the script is not loaded, no cookie is created and nothing is sent to Google. We do not use Google Analytics.

If you consent, the following are transmitted: the page accessed, date and time, browser and device, your IP address and — if you arrived via a Google ad — the click identifier of that ad. In addition, the information on which step you have taken — added to basket, checkout started, ordered — with the respective amount. For an order, this is the order value and your order number; by means of the latter, Google recognises the same order again and does not count it twice.

We do not transmit your name, email address or postal address to Google — not even in converted form. On pages whose address contains a personal key — the link to a saved book (section 4.4) and the link to the status of your order — the Google tag does not start; from all other addresses, we remove what Google does not need to know.

No personalised advertising. We use Google Ads only to measure the success of our ads. The Google tag expressly informs Google that the data may not be used for personalised advertising; as a result, you will not be placed on any audience list for renewed advertising (remarketing).

For this purpose, Google stores cookies under our address (section 5) and may read and set its own cookies under Google domains, such as doubleclick.net. If you withdraw your consent, we remove the entries under our address; we cannot reach those under Google domains — they can be deleted in your browser’s settings.

The sole legal basis is your consent (Art. 6 Abs. 1 lit. a DSGVO, § 25 Abs. 1 TDDDG). We are the controller for the collection via the Google tag on our website and for the transmission to Google. Google is responsible, as an independent controller, for what Google subsequently does with the data; the “Google Ads Controller-Controller Data Protection Terms” apply. Details: policies.google.com/privacy.

Google Ireland may transfer data to its US parent company Google LLC, which is certified under the EU-U.S. Data Privacy Framework (section 9). Nevertheless: according to the current state of affairs, a transfer to the USA cannot be fully protected against access by the authorities there. That is precisely why we ask first.

8.8 Other recipients

There are no other recipients, apart from those of the WhatsApp chat in section 16.5. In particular, no third-party analytics tool such as Google Analytics, no review portal and no newsletter service is integrated. We use AI services only in the WhatsApp chat (section 16.5), not in the editor. Your photos never go into the advertising measurement of Meta or Google — neither the pixel nor the Conversions API nor the Google tag receives image data. If you send us photos via WhatsApp, they pass through the platform of WhatsApp Ireland Limited, a Meta group company, which transmits them as our processor (section 16.5). Data are disclosed to authorities only insofar as we are legally obliged to do so.

9. Transfer to the USA

Vercel, Resend, Upstash and — where consent has been given — Meta and Google are linked to US companies; in the case of Stripe, our contractual partner is based in Ireland, but involvement of the US parent company cannot be ruled out. Although the Upstash database is located in Frankfurt am Main, access from the USA is not ruled out. Processing in the USA is therefore possible. Vercel, Resend, Upstash, Stripe, Inc., Meta Platforms, Inc. and Google LLC — as well as Amazon Web Services — are certified under the EU-U.S. Data Privacy Framework. For certified recipients, the European Commission has decided that an adequate level of data protection is ensured; the transfer is therefore based on Art. 45 DSGVO. In addition, the standard contractual clauses of the European Commission pursuant to Art. 46 Abs. 2 lit. c DSGVO from the data processing agreements apply. For the WhatsApp chat, WhatsApp with its US companies as well as Replicate and OpenAI are added; Replicate and OpenAI are not certified. Details are set out in section 16.6.

The US Department of Commerce keeps a public list of the companies that are certified: dataprivacyframework.gov.

10. Storage period

• Access logs (section 3): for a short period in accordance with our hosting provider’s specifications, then automatic deletion.
• IP address for abuse prevention (section 7.3): only in the working memory of the server instance, expiring after a short time without permanent storage.
• Visitor count (section 6): the visitor identifier in your browser until you delete the website data. The entry “what has already been counted today” in the browser until the following day. On our server only as a hash value: in lock entries until 2 a.m. after the respective day (at most 26 hours), in the list of those currently present a few minutes, at the latest just over an hour. The lock for a counted purchase 26 to 27 hours. Daily totals without personal reference 400 days in the counting database; as part of our business analysis, they may be kept for longer. The list of filtered-out robot requests and the sample of browser identifiers with at most 500 and 300 entries respectively; an entry drops out as soon as that many newer ones have been added, at the latest 30 days after the most recent entry in its list.
• Contact enquiries: until your matter has been conclusively resolved; then deletion, unless a statutory retention obligation precludes this.
• Uploaded files relating to an order that has not been completed: 7 days. After that, we delete them automatically and completely, without any action on your part. If the file belongs to a paid order, it is not regarded as a draft and is kept until 30 days after your book has been shipped.
• Photos, book drafts, basket in the editor: are stored with you in your browser and remain there until you delete them. We can neither view nor delete them — unless you have stored your book using “Buch sichern” (save book) (section 4.4); in that case, the period of 7 days applies to the stored copy.
• Your cookie decision: until you change it or delete your browser’s website data.
• Entries of Google Ads under our address (name begins with `_gcl`): as a cookie, 90 days from the last time it was set; in localStorage until withdrawal of consent or until you delete your browser’s website data. When you withdraw your consent, we remove both.
• Data relating to a code in the WhatsApp message (section 8.5): on our server, two hours from the tap on the button; if your message with the code arrives within this time, at most eight days from that message. After that, the database deletes them automatically; after a withdrawal of consent and when a new code arrives in your chat, immediately. In the browser (`sb.chatklick`) until our server has confirmed a withdrawal, for no longer than eight days and two hours from the tap, or until you delete your browser’s website data; a code whose period has expired drops out the next time our website is accessed. With an order, we keep the time, version and policy version of your consent and the campaign parameters, and the code only until payment – no IP address, no browser data, no cookie values; the period for order data applies to these.
• Events transmitted to Meta and Google: the storage period is determined by Meta and Google; we have no influence on it and cannot delete them there. Withdrawal of consent prevents future transmissions.
• Order data (order number, items, prices, name, address, email address): until processing has been completed in full, then for the statutory retention periods pursuant to § 147 AO and § 257 HGB. During this time, processing is restricted to retention.
• Photos and print files of a paid order: until 30 days after your book has been shipped, so that we can reprint in the event of a complaint. After that, we delete them automatically; the retention periods of the previous item do NOT apply to them — a photo is not an accounting record.

11. No automated decision-making

Automated decision-making, including profiling, within the meaning of Art. 22 DSGVO does not take place. The automatic layout arranges images on pages and suggests crops — a design aid that you can override at any time and that does not produce any legal effects concerning you.

12. Your rights

You have the following rights vis-à-vis us:

• Access to the data processed concerning you (Art. 15 DSGVO)
• Rectification of inaccurate data (Art. 16 DSGVO)
• Erasure (Art. 17 DSGVO), unless a statutory retention obligation precludes this
• Restriction of processing (Art. 18 DSGVO)
• Data portability (Art. 20 DSGVO)
• Objection to processing that we base on Art. 6 Abs. 1 lit. f DSGVO (Art. 21 DSGVO)
• Withdrawal of consent with effect for the future (Art. 7 Abs. 3 DSGVO), where consent has been given — the lawfulness of the processing carried out up to that point remains unaffected

An informal message to support@sundaybooks.eu is sufficient to exercise these rights.

With regard to anything that is stored solely in your browser — your photos, your book drafts, your basket — we cannot provide you with any information or delete anything, because we have no access to it and cannot identify you on the basis of these data (Art. 11 DSGVO). These data are exclusively in your hands: via the editor or your browser’s settings.

13. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedies, you have the right to lodge a complaint with a data protection supervisory authority. The authority competent for us is the one at the registered office of YouVenture! GmbH: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (datenschutz-hamburg.de). You may also contact the supervisory authority of your place of residence or your place of work.

14. Changes to this policy

We adapt this policy when our offering or the legal situation changes. Most recently on 28 October 2026: sections 2, 8, 8.8 and 9 now state expressly what applies to the WhatsApp chat: there, AI models look at your photos, and WhatsApp Ireland, a Meta group company, transmits the chat as our processor (section 16). Section 8.3 lists in full what Stripe receives from us, including the title of your book. Section 10 states the period for photos and print files of an order precisely: 30 days after shipping. Section 7.2 states more precisely when photos reach our support mailbox, sections 16.5 and 16.7 mention the page-flip video of your book, section 16.2 states that the reminder about an open order offers a discount, section 6.1 mentions the counting for the comparison of two versions of the price information, and under section 16.2 the assistant reminds you about an open order at most twice, the second time on the last day of the discount. The prepared WhatsApp message reads “Hallo! Ich möchte ein Fotobuch gestalten 📸” (“Hello! I’d like to create a photo book 📸”) on all pages (sections 8.5 and 16.1). Before that, on 22 October 2026: the visitor count filters out search engines and test robots — by the browser identifier and by IP addresses from Meta’s data centres — and for this purpose keeps a list of the filtered-out requests and a sample of browser identifiers (sections 6.2, 6.3, 8.6 and 10). In addition, section 5 no longer refers to the button that opens WhatsApp by its former name “Jetzt WhatsApp öffnen”. Before that, on 19 October 2026: the prepared WhatsApp message reads “Fotobuch starten 📸” on all pages (sections 8.5 and 16.1). Before that, on 14 October 2026: the code from section 8.5 no longer appears as a visible line in the prepared WhatsApp message but invisibly after the emoji; section 8.5 explains how you can remove it before sending, and sections 16.1 and 16.2 have been adapted accordingly; the prepared message read “Los geht’s! 🎉” on all pages. We do not use consent given before this version for the code. The visitor count now also counts a tap on a button that opens WhatsApp (section 6.1). Before that, on 13 October 2026: section 8.5 describes the code in the prepared WhatsApp message and the reporting of a paid purchase from the chat to Meta, both only with your consent; sections 5, 8.6, 10 and 16.2 have been supplemented accordingly. In addition: the assistant in the WhatsApp chat sends reminders about missing photos and about an open order, based on our legitimate interest, and “Stop” unsubscribes from them (section 16.2); in the case of a reply to an earlier message, we know which one, and in the case of a photo so does the AI (sections 16.1 and 16.5); after a restart, the title and a “Stop” remain, after a payment the note that payment has been made, and the period of the chat starts again (section 16.7); reminders and individually removed photos are also counted (section 16.9). Before that, on 5 October 2026: section 16 was added, covering design and ordering via WhatsApp with an AI assistant; for this route, it takes precedence over the other sections. In addition, section 8.5 mentions the step “WhatsApp chat opened”, and section 16.9 the counting of steps in the chat as daily totals; section 6.1 states that the order page and the thank-you page from the chat do not report to the visitor count. Before that, on 22 September 2026: email address and country of delivery are sent to Meta in converted form as soon as “Zahlungspflichtig bestellen” (order with obligation to pay) is clicked, not only after payment; name, postcode and town are no longer sent to Meta at all, not even after payment (section 8.5). Before that, on 21 September 2026: Google Ads was added, exclusively with your consent (section 8.7); “Other recipients” has therefore moved from 8.7 to 8.8, and sections 2, 5, 8, 9 and 10 have been adapted accordingly. On the same day, section 8.5 incorporated two restrictions on the Meta Pixel: no automatic events, no pages with a personal key. The policy was drawn up together with the Google tag, not afterwards. Before that, on 17 September 2026: the visitor count with the purchase funnel was added (section 6), together with Upstash as operator of the counting database (section 8.6); sections 2, 3, 5, 8.1, 8.7 (now 8.8), 9 and 10 have been adapted accordingly. The policy was drawn up together with the count, not afterwards. Before that, on 14 September 2026: the Meta Pixel was added (section 8.5). The currently applicable version can always be found here on sundaybooks.eu.

15. Contact

If you have any questions about data protection or wish to exercise your rights, you can reach us at support@sundaybooks.eu or by post at YouVenture! GmbH, Ericusspitze 4, 20457 Hamburg.

16. Design and ordering via WhatsApp

You can also have a book designed for you via WhatsApp. You send us photos in a chat, an AI assistant puts your book together from them, and the order is placed on an order page on sundaybooks.eu. This section describes what happens to your data in the process. For this route, it takes precedence over the other sections insofar as they state otherwise. This concerns in particular sections 2, 4, 8, 9 and 10, which describe designing in the editor. Here, too, the controller is YouVenture! GmbH (section 1).

16.1 Data processed

When you write to us via WhatsApp, we process:

• Your telephone number and the identifier that WhatsApp assigns to you for our business. If you use a WhatsApp username, we may receive only this identifier. We use it to assign your messages to your chat and to reply to you. From the country calling code of your number and, if you come via one of our pages, from the language of the prepared message, we also recognise in which language to write to you and in which currency to state prices; we store both with your chat. We do not store your WhatsApp profile name.
• Your messages: texts, replies to selection buttons and the time of each message; if you reply in WhatsApp to an earlier message, also which one.
• Your photos. We store every photo unchanged, because that is what is printed from. A photo sent as a file contains the information that your camera has written into it (EXIF), such as the time of capture and, if your camera records it, the location of capture. Of this, we use only two items: the orientation, so that the photo is the right way up, and the time of capture. We use the latter to put the photos in order and to place chapters, titles or subtitles in time (such as “July 2026”). For this purpose, the AI also receives the time of capture, as date and time (section 16.5). In addition, we create a reduced-size copy of each photo without the embedded camera data. As an image, the AI sees only this copy. It does not receive the location of capture.
• Your voice messages. We have them converted into text and then work only with the text (section 16.4).
• Results of the AI: for each photo, a short description (such as “two children building a sandcastle”), subject, scene and any recognisable occasion. In addition, an assessment of sharpness, exposure and suitability for the cover and for large areas, as well as the focal point of the image that is to remain in the picture when cropping; for people, this is the position of the faces. Furthermore, the plan of your book and the book built from it.
• When you place an order, the country of delivery that you choose on the order page and the information that you then enter on Stripe’s payment page: name, delivery address and email address. Stripe returns this information to us (section 8.3); we use it as described in section 4.3.
• Where you come from. If you open the chat via one of our pages, a message is ready for you there (“Hello! I’d like to create a photo book 📸”). If it comes from an earlier version of our pages, we recognise from it the occasion of the page (such as “baby album”). If you come directly to the chat via an ad, WhatsApp transmits the identifier of that ad to us. We store both with your chat and, where applicable, with your order, in order to adapt the greeting and to see which advertising leads to orders (Art. 6 Abs. 1 lit. f DSGVO).

16.2 Purpose and legal basis

We process these data in order to design your book at your request, to show it to you in the chat and to implement your change requests. If you place an order, we also use them to perform the contract of sale. The legal basis is Art. 6 Abs. 1 lit. b DSGVO (steps taken at your request prior to entering into a contract, and performance of the contract). We use photos and voice messages exclusively for your book, not for advertising, not for analyses about you and not to train AI models. How far chats get overall is counted only as daily totals, without any reference to you (section 16.9).

If your book is left untouched for a while, the assistant reminds you of it – about missing photos at most once per book, about an order that is still open at most twice, only within 24 hours of your last message and never between 9 p.m. and 9 a.m. The legal basis for this is Art. 6 Abs. 1 lit. f DSGVO; our legitimate interest is that a book that has been started is not lost unnoticed. You can object to this at any time (Art. 21 DSGVO): write “Stop” or tell the assistant that you do not want any reminders, and no further reminders will be sent in this chat. The first reminder about an open order offers you a discount on your book; the second comes on the last day of this discount, which then ends at midnight. Beyond this, we do not send you any advertising messages via WhatsApp.

The order link in the chat carries a random, signed identifier of your chat. Anyone who has the link can view and order your book as long as the chat exists (section 16.7). You should therefore only share it deliberately. Because the address of the order page carries this key, neither the Meta Pixel nor the Google tag runs there. To prevent abuse, we briefly count the order attempts per IP address in working memory there, as with the contact form (section 7.3).

If you have consented to measurement by Meta on our website (section 8.5), the prepared message additionally carries an invisible code after the emoji (section 8.5); in an earlier version, it appeared visibly on a separate line, such as “Ref. K7F-3QX-2MD”. If it arrives unchanged, we remove it from the message before the assistant reads it, and store the code with your chat, like the page via which you came (section 16.1), also after a restart (section 16.7), and with an order until it has been paid. We use it to report a purchase from the chat to Meta, as described in section 8.5. The legal basis for this is your consent (Art. 6 Abs. 1 lit. a DSGVO, § 25 Abs. 1 TDDDG), not our legitimate interest.

16.3 The AI assistant

In the chat, you are answered by an AI assistant, not a human. It tells you so in its first message. It looks at every photo, makes a selection and arranges the photos into a story. It decides which photos are shown large and which one goes on the cover, chooses a design template and suggests a title if you do not provide one. It leaves out blurred or almost identical photos and images that are not photos, such as screenshots, and tells you so. It translates your change requests, typed or spoken, into changes to this plan. The pages themselves are laid out by our software according to fixed rules.

The AI describes people only in general terms, such as “a couple” or “two adults and a child”. We instruct it not to recognise anyone, not to guess names and not to match people with one another across several photos. No biometric identification takes place.

The assistant does not take any decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you (Art. 22 DSGVO). It makes a proposal for the design of your book. You see the result before ordering and can have any selection changed, including bringing back anything left out. Only what you approve on the order page is ordered.

16.4 Voice messages

We have a voice message converted into text by a speech recognition model. For this purpose, we upload the recording to Replicate (section 16.5) and arrange for its deletion immediately after the conversion. We do not store it on our servers. The assistant shows you the recognised text (“I heard: …”) so that a mishearing is noticed immediately. After that, it treats the text like a typed message.

16.5 Recipients

For this route, we use the following in addition to the service providers from section 8:

• WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, as processor for our business account on the WhatsApp Business Platform. The entire chat runs via WhatsApp in both directions: your messages, photos and voice messages and our replies, including the preview images and the page-flip video of your book. On the way between your phone and the platform, the messages are encrypted; the platform decrypts them for us. According to Meta, the platform stores messages for a maximum of 30 days, for example in order to retry a delivery. Images and videos uploaded by us remain there for up to 30 days. Your use of WhatsApp itself is governed by the terms and the privacy policy of WhatsApp: whatsapp.com/legal/privacy-policy-eea.
• Replicate, LLC, 101 Townsend Street, San Francisco, CA 94107, USA, for analysis by AI models. This comprises the assessment of each photo, the design of the book, understanding your requests and converting your voice messages into text. For this purpose, Replicate receives the reduced-size copies of your photos without the embedded camera data, overview images with numbered thumbnails of your photos, the time of capture (date and time) of each photo that has one, the previous results of the AI concerning your photos, the wording of your messages and of your title, including the recognised text of your voice messages, in the case of a reply to one of your photos also which one is meant, and the recordings of your voice messages. According to Replicate, the inputs and outputs of such requests are deleted automatically after one hour.
• OpenAI (USA). The models used (GPT-5 mini, GPT-5.4 and GPT-4o Transcribe) are from OpenAI. Replicate may pass the data mentioned on to OpenAI for execution. According to OpenAI, data received via its application programming interface are not used to train AI models unless the user of the interface expressly agrees to this. OpenAI retains abuse monitoring logs, which may contain requests and responses, for up to 30 days; for the conversion of speech into text, OpenAI does not state any such retention. According to its own information, OpenAI checks images for depictions of child sexual abuse and may retain them for longer for this purpose.
• Vercel (section 8.1) operates the connection to WhatsApp and the order page. We store your photos and the current state of work on your book there in the non-public storage in Frankfurt am Main, as in section 4.3. Upstash (section 8.6) stores the state of your chat, in the same database in Frankfurt am Main.
• When you place an order, the recipients from sections 8.2 to 8.4 are added: Resend for the emails, Stripe for the payment and MediaPrint for printing.

16.6 Transfer to the USA

According to its own information, WhatsApp Ireland transfers data to WhatsApp LLC and Meta Platforms, Inc. in the USA. In doing so, it relies on the EU-U.S. Data Privacy Framework and, alternatively, on standard contractual clauses. Both companies are on the Data Privacy Framework list (section 9).

Replicate and OpenAI are based in the USA and are not on this list. There is therefore no adequacy decision of the European Commission for the transfer to them. According to the current state of affairs, a transfer to the USA cannot be fully protected against access by the authorities there.

16.7 Storage period

• State of your chat (list of your photos, results of the AI, your title and your requests): until the end of the chat, 7 days after your first message, or after a restart 7 days after the restart. The database then deletes it automatically. If you write to us again after that, a new chat begins without the old photos.
• Photos, reduced-size copies, plan and built book: each file 7 days from when it was last saved. After that, we delete them automatically and completely. If you place an order, section 10 applies to the photos and print files of the order.
• Messages still awaiting processing: at most one day. They are usually processed within seconds.
• Checksums of the message identifiers: eight days, so that a message delivered twice by WhatsApp is not processed twice.
• Assignment of your order number to your chat: until the confirmation has been sent in the chat, at most eight days. After that, the state of your chat records only that payment has been made – so that the assistant does not remind you of a completed order – until the end of the chat.
• Counting of the steps in the chat: the note of which steps your chat has reached, until the end of the chat; the daily totals, which have no reference to you, 400 days (section 16.9).
• Voice messages: on our servers not at all; at Replicate until deletion immediately after the conversion (section 16.4).
• At WhatsApp: messages at most 30 days, images and videos uploaded by us up to 30 days (section 16.5).
• At Replicate and OpenAI: inputs and outputs of a request one hour, according to Replicate. What OpenAI retains is set out in section 16.5.

If you ask the assistant to start again and confirm this, we delete the state of your chat immediately. Until the end of the chat – 7 days after the restart – only the following remain: the title that you set for your book in the chat, the page or ad via which you came (section 16.1), whether you have unsubscribed from reminders (section 16.2), and the note of which steps your chat has already reached (section 16.9) — so that the same chat is not counted a second time after a restart. The stored files expire with the period stated above.

16.8 Your rights

Your rights under section 12 and the right to lodge a complaint under section 13 also apply here. For access, rectification or erasure, an informal message to support@sundaybooks.eu is sufficient. Please state the telephone number with which you wrote to us. You manage what is stored in WhatsApp on your phone yourself.

16.9 Counting of the steps in the chat

In order to see at which point conversations with the assistant stall, and to improve the process, we count how many chats reach certain steps: chat started, greeted, first photos sent, enough photos for a book, design started, book built, preview with the route to ordering shown, order requested, cover type selection sent, order page opened, Stripe payment page opened and paid. We also count whether a chat requested a change or started again, whether photos were removed individually, whether a book was blocked or its building failed, whether the assistant sent a reminder about missing photos or about the order and whether a reply followed, and how often a book was rebuilt following a request.

Only daily totals are stored — such as “12 chats started, 5 books built, 2 paid” —, broken down by the occasion of the page via which the chat began and by whether it came via an ad (section 16.1). The totals contain no telephone number, no identifier, no messages and no photos and do not allow any conclusions to be drawn about an individual. We keep them for 400 days, in the Upstash database (section 8.6). So that each step counts only once per chat, we note in the state of your chat the names of the steps that it has already reached, without a timestamp; this note ends with the chat (section 16.7). Whether payment was made is counted on the basis of the order, without your chat.

The legal basis is Art. 6 Abs. 1 lit. f DSGVO; our legitimate interest is an ordering route in the chat that works and whose weak points we know. We do not create profiles from this, and the contents of your messages, photos and voice messages are not included. You can object to the count (Art. 21 DSGVO); an informal message is sufficient (section 16.8). We then note the objection in the state of your chat, and from then on no step of your chat is counted, not even the payment of an order from it. The note ends with the chat; if you write to us again after that, a new chat begins. The totals from before cannot be attributed to anyone and remain in place.